MikroTik RouterOS Flaws Exploited to Hijack Internet-Exposed Devices
Summary
CERT Polska says attackers are exploiting the MikroTrick chain to take over internet-exposed MikroTik devices via SSH. MikroTik released patched RouterOS versions; administrators should update and check for signs of compromise.
Key points
- CERT Polska disclosed six RouterOS vulnerabilities; two flaws combined in the MikroTrick chain can enable unauthenticated full device control when SSH is internet-accessible.
- CVE-2026-67276 allows SSH authentication bypass through an RSA public-key modulus comparison flaw; CVE-2026-86060 can grant full administrative privileges.
- CVE-2026-67277 affects the bandwidth-test service and could expose kernel memory or crash a device; three other flaws affect the SSH client, X.509 handling, and WebFig.
- CERT Polska reports observing attacks and confirmed successful exploitation; it linked successful attacks to 82.192.72.4 and identified 103.102.31.18 in exploit attempts.
- Possible compromise indicators include unexplained privileged user “ops,” suspicious SSH log entries, a Flagged marker, and unknown users, scripts, or configuration changes.
- MikroTik released fixes in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; CERT Polska recommends immediate updates and configuration review.
- If updates cannot be installed immediately, CERT Polska advises disabling exposed services or restricting them to trusted management networks; these are temporary measures.
Article Details
- Vulnerability Types
- SSH authentication bypass
- Privilege escalation
- Unauthenticated bandwidth-test service access
- Uninitialized packet-buffer data exposure
- Integer underflow in size validation
- Severity
- CVSS 9.2 for CVE-2026-67276 and CVE-2026-86060; CVSS 8.8 for CVE-2026-67277.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- If patching cannot be done immediately, disable exposed SSH, WWW/WWW-SSL, and bandwidth-test services, or restrict them to trusted management networks.
- Avoid TLS connections or use of the built-in SSH client from an unpatched device over untrusted networks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]102[.]31[.]18 | IP address flagged by CERT Polska as used in attempts to exploit the same vulnerability chain. |
| IPV4 | 82[.]192[.]72[.]4 | IP address to which CERT Polska traced confirmed successful attacks, including creation of the suspicious ops account. |
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationCVE-2026-86060 allows an attacker to obtain full administrative privileges through a crafted SSH username.T1098 · Account ManipulationSuccessful attacks created a highly privileged user account named ops.T1110 · Brute ForceCVE-2026-67276 allows login without the account's private key by crafting a different RSA key using the known username and public-key modulus.T1190 · Exploit Public-Facing ApplicationAttackers exploited RouterOS vulnerabilities on internet-accessible devices to gain control.
CVE
Vendors
Products
Tools
GPT-5.5-cyberThe vulnerabilities were discovered using the GPT-5.5-cyber and GPT-5.6-sol models, through the team’s access to OpenAI’s Government and Trust Agency Collaboration program.GPT-5.6-solThe vulnerabilities were discovered using the GPT-5.5-cyber and GPT-5.6-sol models, through the team’s access to OpenAI’s Government and Trust Agency Collaboration program.